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1.0 INTRODUCTION 

As discussed in “Design of Lightning Protection for a Full- 
Authority Digital Engine Control” [1], FADEC systems present 
many challenges to the lightning protection engineer. In addition, 
verification of the protection-design adequacy for certification pur- 
poses presents additional challenges. In particular, close coordina- 
tion between the airframe manufacturer and the suppliers of systems 
and subsystems is required. 

The basic requirement of the certification plan of a FADEC 
system is to demonstrate compliance with Federal Airworthiness 
Regulations (FAR) 25.1309 [2] and 25.581. Certain FAR Issue 
Papers may be applicable and the forthcoming FAR 25.131 5 [3] will 
clarify some ambiguities in the FARs pertaining to lightning protec- 
tion of flight-critical and essential systems. These FARs are intended 
for transport aircraft, but there are equivalent sections for general 
aviation aircraft, normal and transport rotorcraft. Military aircraft 
may have additional requirements. 

The criteria for demonstration of adequate lightning protection 
for a FADEC system includes the procedures outlined in Federal 
Aviation Administration (FAA) Advisory Circular (AC) 20-136 
“Protection of aircraft electrical/electronic systems against the indi- 
rect effects of lightning.” [4] As FADEC systems, including the 
interconnecting wiring, are generally not susceptible to direct attach- 
ment of lightning currents, this paper deals primarily with the 
verification of protection against indirect effects. 

It is the responsibility of the airframe manufacturer or system 
integrator to provide the overall assurance of adequate lightning 
protection. However, it is often the case that the airframer’s certifi- 
cation plan will refer to test or analysis plans conducted by system 
suppliers. 

2.0 VERIFICATION METHODS 

Verification of protection against lightning indirect effects is 
accomplished by the following procedures: 

1. Demonstrating that actual transient levels in the 
interconnecting wiring do not exceed theestablishedTCLs 
for the wiring. 

2. Demonstrating that the individual equipmentwilltolerate 
the ETDLs without component damage. 

3 . Demonstrating that interconnected and operating systems 
will tolerate the applicable ETDLs (as applied to the cables 
of an interconnected system) without component damage 
or system functional upset. 

The accepted methods of verification are through similarity of 
design with existing systems or aircraft, mathematical analysis or 
through simulated lightning testing. 

2.1 SIMILARITY 

Verification by similarity must be demonstrated by detailed 
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comparisons of drawings, parts lists, system operating parameters 
and installation details. The certification plan must show that the 
FADEC systems, and the portions of the airframe which contain the 
systems, are identical to a previously certified system from a 
lightning-protection standpoint. Most importantly, the certification 
plan must show that TCLs, ETDLs and margins will remain similar. 
As FADEC systems are relatively new to the transport aircraft 
market and because of the rapidly developing technology of elec- 
tronic control systems, certification entirely through similarity is 
rare. 

2.2 ANALYSIS 

Mathematical analysis is often used in the development stages of 
an aircraft, before prototypes are available, to determine the levels of 
lightning-induced transients that may be expected. For certification 
purposes, the use of “acceptable” mathematical analysis is often 
limited to certification documents describing lightning protection 
for small engineering changes. More frequently, analysis is used in 
conjunction with one or both of the other forms of verification. A 
common example is the extrapolation of the effects of high current 
from the results of a low-current test. Analysis should always include 
the worst-case scenario. Generally, verification by analysis will 
require significantly higher margins between TCL and ETDL than 
other forms. 

2.3 TESTING 

Conceptually it would be best to perform full-threat testing on 
fully configured and operational aircraft, performed either on a Go/ 
No-Go basis or with a measurement and analysis scheme. This is 
seldom practical, however, primarily because of the cost and com- 
plexity of the required test equipment, test specimen and test facility. 
Therefore, to determine the indirect-effects protection of a FADEC 
system, testing will usually consist of two general categories of 
simulations: aircraft-level tests such as lightning transient analysis 
(LTA), used to determine the TCLs in the airframe or major sections 
of the airframe, and ETDL tests, performed with FADEC system 
components installed in the airframe. The second main category 
consists of a variety of bench tests performed on system components 
to assess protection against damage and functional upset. 

2.4 TCL VERIFICATION 

Verification of TCL will be accomplished by one of the 
following methods: 

• Performance of a full-vehicle lightning test, in which 
reduced-scale pulses of current with waveforms of 
components A and H are circulated through the aircraft and 
measurements are made of actual transients induced in 
typical individual conductors and bulk cables associated 



with the flight critical/essential systems. The measured 
transients are then extrapolated linearly to predict the 
levels that would be induced by full-threat component A 
and H currents. This procedure is also known as an LTA 
test. Measurements are made on representative circuits/ 
cables, in accordance with a detailed test plan. 

• Computation of anticipated actual transient waveforms/ 
levels in representative wires/cables by analysis based on 
first principles (laws of electromagnetic effects, aircraft 
material properties and geometry). The analytical 
technkjuesutilizedareverifiedbycomparison with available 
prior test data. 

* A combination of both of the above procedures. The 
extent to which each method will be employed will be 
detailed in test and/or analysis plans, to be submitted to 
airworthiness certifying authorities for approval. 

2.5 ETDL VERIFICATION 

Verification of compliance with the ETDLs specified is to be 
accomplished by tests conducted by the system or equipment ven- 
dors in accordance with test plans to be submitted by diem to the 
airframe manufacturer for approval. Two test methods will be 
employed, as follows: 

* Pin-injection tests in which full-scale voltage/current 
transients are applied (in most cases) between individual 
pins and case ground to verify circuit board component 
tolerance of die specified ETDLs. 

• Bulk-cable tests, in which the specified cable ETDLs 
(bulk-cable currents) are transformer coupled or directly 
injected into interconnecting cables, with the system 
powered up and operating. The primary purpose of these 
tests is to verify that the system does not upset, although the 
test also verifies protectionagainst system-related damage 
effects. 

3.0 CERTIFICATION PLAN FORA 
ROTORCRAFT FADEC/ENGINE 
SYSTEM 

The following example of a certification plan for a hypothetical 
system provides detailed procedures applicable to most FADEC 
applications. This example addresses specifics for a rotorcraft 
FADEC/engine system, designated LT1-1000, including an Elec- 
tronic Control Unit (ECU) and a Hydromechanical Control Unit 
(HMU). However, the general procedures and steps would be appli- 
cable for fixed-wing aircraft installation of the same or similar 
engine system, though changes in some o f the ETDLs and TCLs may 
be necessary . The certification plan would begin with several brief 
introductory sections describing the purpose and citing the specific 
FAA and DoD requirements relevant to the rotorcraft. Our example 
begins after the opening paragraphs: 

3.1 INTRODUCTION 

- provide an overview of the system and application. 

3.2 PURPOSE 

- state goals of certification plan. 

3.3 REQUIREMENTS 

- cite specific FARS, ACs, MIL-STDs and issue papers as 

applicable. q 


3.4 LIGHTNING CRITERIA 

The lightning environment which the helicopter (or fixed-wing 
aircraft) must withstand is defined in Appendix III of AC 20- 1 36 [4] 
and Section 3.3 of MIL-STD-1795. [5] 

These references define fire same lightning environment, which 
is represented by current components A through D, a multiple-stroke 
arrangement of components A and D/2, and a multiple-burst environ- 
ment. These components are fully defined in the aforementioned 
references and will not be described further here. They represent the 
characteristics of lightning-stroke currents entering, flowing through 
and exiting from an aircraft. 

Applicability of individual components of die lightning environ- 
ment to specific airframe surfaces or structures depends on the 
lightning strike zones of such surfaces/structures. Zone definitions 
are also found in AC 20-136 [4] and MIL-STD-1795A. [5] 

3.5 STEPS IN DESIGN AND 
VERIFICATION 

This section describes die steps being followed in design and 
verification of lightning protection for the LTI-1000 electronic 
control system. The steps described herein are similar to those in 
Section 7 of FAA AC 20-136 [4] (Steps a through g). Several of the 
steps include performance of tests. Plans for these tests are provided 
in separate documents, referenced herein. 

3.5.1 Step a - Locate the lightning-strike zones 

The LTI-1000 engine installed in the helicopter is not susceptible 
to direct lightning strikes. Instead, they are subject to lightning 
strikes conducted on and off the engine via the drive shaft, engine 
mounts, electrical wiring harnesses, fuel and drain lines. Systems 
and components exposed to such conducted currents are in zone 3, 
see Figure 1. 

3.5.2 Step b - Establish the external environment 
for the zones 

The external environment components applicable to specific 
zones are found in Appendix III of AC 20-136 [4], reproduced herein 
as Table 1, 


Table 1 - Zonal Application of the External 
Environment for Determination of Indirect Effects 


Zone 

Current Waveforms [ 


A 

B 

C 

D 

Multiple 

Multiple 






Burst 

Stroke 

1A 

X 

X 



X 

X 

IB 

X 

X 

X 

X 

X 

X 

2A 


X 


X 

X 

X 

2B 


X 

X 

X 

X 

X 

3 

X 

X 

X 

X 

X 

X 


Note: Indirect effects resulting from components B and C are 
usually insignificant. 
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FIGURE 1 Strike zones for helicopters 


Since components B and € produce insignificant indirect effects 
and the effects of component D are exceeded by those of component 
A, the LTI-1000 electronic control system is being designed to 
tolerate the indirect effects of current component A and the multiple* 
stroke and multiple-burst environments being conducted through the 
airframe. Since the LTI-1000 will be employed in a helicopter, the 
zone 3 currents will be conducted into the engine via the main rotor 
shaft, gearboxandengine output shaft. Lightning current will exitthe 
engine via all other electrically continuous paths between the engine 
and the airframe. 


3.5.3 Step c - Establish the internal environment 

The internal lightning environment consists of lightning currents 
conducted into and out of the engine via the aforementioned conduc- If 
tive paths. The amount of lightning current that may flow in each path 
cannot be determined exactly by analysis, due to the complexity of ;;; 
the airframe and engine installation design and difficulty of quanti- § 
tying electrical impedances associated with mechanical parts. How- | 
ever, gross estimates can be made of current magnitudes and, if | 
simplifying assumptions are made on a worst-case basis, the result- | 
ing magnitudes will be higher than those actually experienced. | 

1 

3.5.3.1 Lightning-current flow paths 

3.5.3. 1 . 1 Current entering engine 

Nearly all lightning strikes to a helicopter enter the mainrotor and 
exit from one or more of the lower extremities such as landing gear, 
skids, or tail boom. The lightning current path to an engine is 
illustrated basically in Figure 2. 

Figure 2 shows a single-engine installation. In this figure, the 
following simplifications have been made, which result in the 
percentage of current entering the engine being higher than is 
actually expected to occur. 

Simplifying Assumptions 

• Currentpaths through rotor pitch control rods are omitted. 

• 100% of external lightning current is expected to enter 
main bearing assembly. 

• 50% of lightning current is assumed to flow through main 
bearing to output shafts), even though otherlow-impedance 
paths exist to the airframe via the mechanical-load paths 
(thrust amounts) and a variety of control and sensor paths. 

® A single engine and output shaft is assumed. Twin output 
shafts would share the engine current, resulting in less 
current to each engine. 
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Thus, the percentages of lightning current assumed to flow into 
the gearbox (50%) and engine (40%) are higher than actual, though 
the amount of margin cannot be determined. 

Accordingly, it is assumed that 40% of the applicable full-threat, 
external lightning-current components, (components A, D/2, and H) 
will enter the engine via its output shaft and exit the engine via the 
engine mounts and other available paths. These current magnitudes 
are listed in Table 2. 


Table 2 - Lightning Currents Entering Engine 


Current Component 

Peak Current 

A 

80 kA 

D/2 

20 kA 

H 

4 kA 


The currents of Table 2 represent the internal lightning environ- 
ment applicable to the LTI-1000 engine. 


3.5.3, 1.2 Currents exiting engine 

The lightning current that entered the engine via its output shaft 
will exit from the engine via a variety of conductive paths. These are 
listed in Table 3. 

Table 3 - Current Exit Paths from Engine Path 


Path 

No. 

• Engine and gearbox mounting struts 

7 

• Exhaust duct 

1 

• Common drain 

1 

• Plenum drains 

2 

• Fuel hose 

1 

• Engine starter harness grounds 

1 

• ECS wiring harness 

2 

• Ground strap 

1 

Total number of paths: 

16 


If the current divided evenly, approximately 5 kA would flow 
from the engine to the airframe via each path. Actually, the magni- 
tude of current in each path is determined by its impedance as 
compared with the impedances of other paths, with the highest 
currents flowing in the lowest impedance paths. The shortest, most 
direct paths to the airframe will have the lowest impedance and the 
highest current. These include the gearbox and engine-mount struts. 

The metal cross sections and other aspects of the struts and other 
mechanical paths are fully capable of conducting their share of the 
lightning currents and no further considerations will be given to them 
in this plan. 

It is necessary to establish the peak amplitudes of lightning 
currents flowing in the shields of ECS wiring harness as these 
become part of the TCL and ETDL specifications. For protection 
design purposes, it is assumed that current is shared equally among 
all exit paths and that ECS shield currents are as shown in Table 4 . 
Table 4 - ECS Harness Shield Currents (engine-to- 
airframe) 


Current Component 

Peak Current 

A 

5 kA 

D/2 

1.25 kA 

H 

0.25 kA 


The fact that the ECS shield currents do not, in fact, exceed the 
levels of Table 4 will be verified by test of an engine in a simulated 
helicopter installation, as described in Section 3.5.7 (step g). 

3.5.4 Step d - Identify the flight-critical/essential 
systems 

The LTI-1000 ECS is assumed to be flight-critical as the engine 
is being certified for single- as well as twin-engine applications. All 
components of this system, including the ECU, engine-mounted 
accessories and interconnecting wiring harness are assumed to be 
flight-critical. 

The ECS is exposed only to lightning indirect-strike effects in 
accordance with its zone 3 installation. The engine and ECS are 
protected from direct lightning strikes by the main rotor and the 
engine cowling, which are above the engine. 

3.5.5 Step e - Establish transient control and design 
levels 

The ETDLs represent the amplitude(s) of voltage(s) and/or 
currents) that the ECS equipment is required to tolerate and remain 
operational without damage or system-functional upset. These levels 
are set higher than the maximum amplitude of transients that are 
allowed to be induced in interconnecting wiring and appear at 
equipment interfaces, which are the TCLs. The relationship between 
TCLs and ETDLs is illustrated in Figure 3 . The ETDL is part of the 
specifications for the ECS electrical/electronic components. TCLs 
and ETDLs are defined in terms of the open circuit voltage (Voc) and 
the short circuit current (isc) appearing at wiring/equipment inter- 
faces, and the currents in the shields of ECS interconnecting wiring 
harness. The “V” and “i” will be related by the source impedances 
(i.e., loop impedance) of interconnecting wiring, and different levels 
have been established for signal circuits and 28 VDC power circuits. 
The waveforms/levels defined in Appendix IV of FAA AC 20-136 
[4] have been utilized to establish TCLs and EDTLs for cable shields 
and connector interfaces. 

The equipment transient susceptibility level, also shown on 
Figure 3, is the amplitude of voltage or current which, when applied 
to the equipment, would result in damage to components or upset 
such that the equipment can no longer perform its intended function. 
This level is higher than the ETDL, and is not specified. 

The TCLs and ETDLs for the single-engine helicopter installa- 
tion are defined as individual connector pin-to-case (Voc) and 


equipment transient 
j susceptibility levels 



Interconnecting Electrical/ 
Wiring Electronic 

Equipment 


FIGURE 3 Relationships between transient levels 
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current (isc) waveforms and levels, as this condition is where the 
highest levels of induced effects are expected to appear in the 
helicopter circuits. This is the manner in which verification tests of 
equipment will be performed, as described in 3.5,7 (step g). 

For design and verification of protection against system upset, a 
bulk-cable current is also defined. This represents the total voltage 
and/or current that can be induced in the loop formed between a 
complete cable shield and the adjacent engine or airframe. For 
overbraid shielded cables, or cables comprised entirely of individu- 
ally shielded pairs, this is defined as a bulk-cable current. For 
verification test purposes, the levels will be directly injected or 
transformer coupled into the interconnecting cable while the system 
is powered up and operating, for the purpose of verifying protection 
against system-related damage and upset, as described briefly in 
section 3.5,7 (step g) and the referenced test plans. 

All of the ETDLs are defined in the multiple-stroke mode, as 
defined in AC 20-1 36 [4] (one full-amplitude transient correspond- 
ing to the first return stroke, Component A, followed by twenty-three 
transients corresponding to subsequent strokes, Component D/2). 

Specific TCLs and ETDLs established for the interconnecting 
wiring and electrical/electronic components are shown in Table 5, 

Notes: 1 . Waveforms and levels are defined in FAA AC 20-136 
[4], Appendix IV. 

2. Short-circuit current specification (isc) may be reduced from 
the level defined in AC 20- 1 36 [4] if line-to-case ground impedance 
at airframe or engine-mounted accessory is determined to be greater 
than the impedance (5 ohms or 25 ohms) implied in the definition. In 
no case may the isc level be less than that produced by a 1 00-ohm 
impedance. If the isc specification is reduced in this manner, the 
ability of the remote interface to withstand the specified ETDL must 
be verified by transient test. 

3. The specified shield-current amplitude is the current at the 
ECU interface (connectors El, E2 and E3). Currents in branches of 
intra-engine harness shields will be lower. The total of currents in 
each branch will equal the specified current at the ECU connector. 

4. The short-circuit (isc) current is as specified and may not be 
reduced as described in Note 2. 

Table 5 LTI- 1000 Equipment Transient Design and 

Control Levels 


The transient levels presented in Table 5 represent a margin of 2: 1 
or greater between ETDLs and associated TCLs, in accordance with 
advice given in Section 9 of FAA AC 20- 1 36 . The TCL selections are 
intended to encompass the actual transient levels (ATLs) of the 
shielded conductors, and are generally based on an assumed harness- 
shield transfer impedance of 0,05 volt of conductor voltage per amp 
of shield current; a value typical of short-length shielded harness, 
such as employed between the ECU and other engine-mounted 
accessories. Thus, if the shield-harness TCL is 5 kA as listed in Table 
5, the conductor voltage, Vc would be, 

Vc = (0.05 V/A) (5,000 A) - 250 volts 

hence, a TCL of 300 volts for waveform 4, as defined in AC 20- 
136 [4]. 

The harness-shield TCLs have been based on experience with 
similar-sized engines and installations. Verification that actual- 
shield currents (sometimes called bulk-cable currents) do not exceed 
these levels will be accomplished by test of an engine with typical 
intra-engine and engine-airframe harnesses installed, as described 
briefly in section 3.5.7 (Step g) and the referenced test plans. 

If actual harness-shield currents are found to be higher than the 
proposed TCLs, the TCLs and corresponding ETDLs will be in- 
creased proportionately or a design change will be implemented to 
reduce the ATLs. 

3.5.6 Step f - Design protection 

The LTI-1000 ECS is designed to minimize the magnitudes of 
lightning-induced transients on the wire-harness shields and conduc- 
tors, and to provide protection at the component (box) level in cases 
where expected transients would otherwise exceed component toler- 
ance levels. Some of the protective measures incorporated in the 
LTI-1000 ECS design are listed in Table 6. The adequacy of each of 
those measures will be verified by the tests described in section 3.5,7 
(step g). 



Equipment Interfaces 





Application 

ECU 

Other 

Waveform 
(Note 1) 

TCL 
(Note 1) 

ETDL 
(Note 1) 

Remarks 

LRU connectors, pin- 
to-case ground 

El, E2 

Engine mounted 
accessories inter- 
facing with ECU 

4 

Level 3 

Level 4 


Intra-engine 
harness shields 

E1,E2 

Engine mounted 
accessories 
interfacing with 
ECU 

5A 

5 kA 

10 kA 

Note 3 

LRU connectors, pin- 

E3 

Aircraft signal 

3B 

Level 3 

Level 4 


to-case ground 


interfaces 

4 

Level 3 

Level 4 



E3 

28 VDC power 

4 

Level 3 

Level 4 

ggfggl 

Engine-to-airframe 

E3 

Airframe mounted 
components 

5A 

IBM 

10 kA 
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Table 6 - ECS Protective Measures 


Protective Measure 

Result 

• Improved electrical bonding 
between accessories and engine 

Reduces potential differences 

• Shielding of all intra-engine 

Reduces magnetic field coupling 

harnesses; shields grounded at 

to signal conductors to 

both ends 

insignificant levels 

• Transient suppression diodes 

Reduces incoming transients to levels 

at ECU interfaces to 

that can be tolerated by circuit 

sensitive circuits 

board components 

• Dual-channel design 

Provides a second operational channel to 

and operation 

perform control functions in the event the 
first is upset or damaged 

• Isolation of electrical circuits 

Reduces induced currents to low 

from case ground at engine- 
mounted accessories 

levels, reducing stress at ECU interfaces 


3.5.7 Step g - Verify protection adequacy 

The adequacy of the LTI-1 000 ECS design to withstand lightning 
indirect effects will be verified by four series of tests. Two of these 
verify that actual transients induced in the interconnecting wiring do 
not exceed the established TCLs, and the other two verify lhat the 
ECU and other engine-mounted electrical components can safely 
tolerate the ETDL. These tests are described briefly in the following 
subsections. Complete descriptions are followed in the referenced 
test plans. 

3.5.7.1 Transient control level (TCL) 

3. 5.7.1. 1 Harness shield currents 

Verification that the ECS harness-shield currents do not exceed 
the shield-current TCLs listed in Table 5 will be accomplished by 
tests of an engine with ECS components and interconnecting wire 
harness installed. In these tests, the simulated-lightning currents will 
be injected into the output shaft and allowed to exit the engine via 
simulated mounting struts, drains, harness shields and each of the 
other conductive paths listed in Table 3. These tests will be con- 
ducted on an EMI test rig, which consists of an engine case equipped 
with all engine-mounted accessories and suspended within a frame 
above a ground plane via insulating straps. This enables the actual 
exit paths to be simulated with metal straps, harnesses, etc. Measure- 
ments will be made of currents induced in the ECS intra-engine 
wiring harness, including all of its branches. These are the shield 
currents referred to in Table 5. The engine-airframe cable will also 
be represented in the test so that a measurement can be made of 
current in its shield. In addition, measurements will be made of 
currents exiting the engine via the other paths, for comparison with 
the original assumptions. 

The ECS harness-shield current tests are described more fully in 
the referenced Test Plan #1 . 


3.5.7. 1.2 Conductor voltages and currents 

Actual transient voltages induced in conductors within the ECS 
engine harness will be determined by test of an actual intra-engine 
harness. In this test, the shield currents determined from the engine 
test of section 3.5 .7.1.1. will be injected into the intra-engine and 
measurements will be made of the voltages induced in conductors 
within. This test is conducted on a bench with conductors shorted to 
shields at remote (accessory) ends of the shield branches so that all 
of the conductor voltage and current can be measured at the ECU 
ends. Measurements will be made of induced voltage at open, 
ungrounded ends of conductors extending into each branch of the 
cable (file open-circuit voltage, Voc) and of the current flowing in the 
same conductors when both ends are shorted to the shield (the short- 
circuit current, isc) as these are the parameters by which the TCLs are 
defined. 

Details of the intra-engine harness test are presented in the 
referenced Test Plan #2. 

Actual transient levels in the conductors within the engine- 
airframe harness will not be measured during this test, as this harness 
is furnished by the airframe manufacturer. The TCLs and ETDLs 
established for the airframe interfaces in Table 5 will become part of 
the engine/airframe interface specification. 

3.5.7.2 Equipment transient design level (ETDL) 
verification 

3.5.7.2.1 Damage tolerance 

Verification of ECS component compliance with the ETDLs 
listed in Table 5 will be accomplished by pin-injection tests, in which 
full-scale transients defined in Table 5 and Appendix IV of AC 20- 
136 [4] will be injected into equipment connector-pins, between 
individual pins and case grounds. These tests verify ability of circuit- 
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board components and protective devices to tolerate the established 
ETDLs without damage. 

Pin-injection tests will be conducted on the ECU as well as the 
other ECS engine-mounted accessories. In situations where these 
accessories also have complied with line-to-ground, high-potential 
(hipot) test requirements that exceed the ETDLs, the ETDL pin tests 
may be waived upon presentation of hipot test reports. 

The pin-injection tests are conducted on the ECU in a power-on 
but non-operational status. Other accessories will be tested in a 
power-off configuration. The pin-injection tests are described in the 
referenced Test Plan #3. 


test are available to support the next and substantiate any design 
changes that might be necessitated by test results. In this way, the 
tests provide a building-block approach to certification, and allow 
each level of the protection to be validated. 

Test Plan References 

#1 . Engine-mounted harness-shield current test plan 
#2. Engine-mounted harness-conductor voltage/current 
test plan 

#3. ECS-equipment damage-tolerance test plan 
#4. ECS system functional upset test plan 


3.5.7.2.2 System functional upset 

Verification of the ECS’ ability to continue to perform its 
intended functions during and after exposure to lightning’s indirect 
effects will be demonstrated by a system-upset test of a complete 
engine-mounted ECS, powered up and operating. For this test, 
induced multiple-stroke and multiple-burst transients are trans- 
former-coupled or directly injected into the harness shields while the 
system is operating in each operational mode. These tests will be 
conducted on a system installed on the same engine case that was 
utilized for the harness-shield current tests of section 3.5.7. 1 .1 . The 
test currents will be full-threat, harness-shield ETDLs as defined in 
Table 5, applied in the multiple-stroke mode, with one transient 
corresponding to current component A, as defined in Table 5 
followed by 23 transients ofone fourth this amplitude, corresponding 
to component D/2, all within two seconds, as defined in AC 20-136 
[4]. 

The system-upset test is described in the referenced T est Plan #4, 

3.5.7.3 Sequence of verification tests 

The four tests described in the preceding subsections will be 
conducted in the sequence shown in Figure4 , so that theresults ofone 



determine shield 
currents and verify 
shield TCL’s 


determine conductor 
voltages/ currents 
and verify conductor 
TCL’s 


verify damage 
tolerances of 
ETDL’s 


verify system upset 
tolerance of ETDL’s 


FIGURE 4 Sequence of verification tests 


END OF “LTI-1000 CERTIFICATION PLAN” 

4.0 EXPERIMENTAL METHODS OF 
ANALYSIS 

4.1 AIRCRAFT/ENGINE TCL- 
VERIFICATION TESTS 

As noted in Section 3. 5 .7.1 of the certification plan for the 
hypothetical LTI-1000 engine, the verification that TCLs associated 
with intra-engine cables (i.e., between engine and engine-mounted 
accessories) do not exceed the specified values for these circuits, is 
accomplished by an LTA test of an engine housing with all engine- 
mounted accessories and all intra-engine wiring harnesses in place. 
This low-level pulse test may be conducted on an engine by itself, 
rather than in a completely configured vehicle, because the TCLs of 
interest here are associated only with engine-mounted circuits. For 
verification of the TCLs assigned to the engine-aircraft circuits (i.e., 
between engine and CVU or pilot-input force transducers) a full- 
vehicle LTA test may be required. LTA tests should also include 
measurements of bulk-cable currents, currents on cable shields, 
magnetic fields within structures and structural IR voltages when 
appropriate. 

4.1.1 Approach 

LTA tests usually are low-level current pulse tests with the 
waveshapes of Component A and H as defined inFAAAC20-136[4] 
Appendix III. Other components are not used since the Components 
B and C produce insignificant indirect effects and the effects of 
Component D are exceeded by the effects of Component A. The 
resulting induced voltage and current transients in the aircraft wiring 
and harnesses will be measured and recorded by oscilloscopes 
located in or near the aircraft. Peak currents applied to the airframe 
generally can be limited to 1 kA or less to prevent any damage from 
occurring to the aircraft or avionic equipment. The measured data 
will thenbe extrapolated linearly to predict the actual transient levels 
that would appear in interconnecting wires during a full-threat, 200 
kA stroke to the aircraft. An overview of the procedures and practices 
to conduct low-level pulse LTA tests may be found in “Lightning 
protection testing offull-scale aircraft to determine induced transient 
levels,” by M.M. Dargi [6], “Lightning protection ofaircraft.”[7] and 
NASA CR-2524 “Lightning effects on the NASA F-8 digital-fly-by- 
wire airplane.” [8] No further discussion of full-vehicle tests is 
provided in this paper. 
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4.2 ETDL VERIFICATION TESTS 

In December 1989, the Radio Technical Commission for Aero- 
nautics (RTCA) issued revision C of DO- 1 60 Section 22, providing 
standard procedures for the conduct of lightning-induced transient 
susceptibility tests. Because of the rapid proliferation of sensitive 
electronics into more and more aspects of flight control, the trend 
toward lower operating voltages in these electronics, and the advent 
of “off-the-shelf’ aeronautic devices intended for installation in a 
variety of applications, RTCA DO- 1 60C Section 22 has been deemed 
inadequate. Since that time, the committees SAE AE4L and 
EURQCAE WG-3 1 SGI have been working on a revision. This will 
address, in greater detail, the waveforms, test levels, configuration 
of equipment-under-test (EUTj, test procedures, measurement pro- 
cedures, test equipment and safety procedures required for the 
conduct of ETDL verification tests for individual LRUs. Additional 
tests are usually necessary for verification of complete, intercon- 
nected FADEC and FBW systems. 

As ETDL tests are generally bench tests performed by the 
equipment vendors to the specifications of the system integrator or 
airframe manufacturer, the success of the overall lightning protec- 
tion for the entire aircraft may depend on the authenticity of the test 
simulation conducted by the equipment vendor. It may not be 
sufficient to perform ETDL tests, especially for system-fUnctional 
upset, on a generic basis. It is preferable to perform ETDL analyses 
which relate to the actual configuration for the specific aircraft. 
Using DO- 160 as a baseline, engineers should tailor ETDL tests to 
reflect actual operating loads, power- and signal-cable sizes, types 
and routing. Failure to do so could, at best, result in unneccessary 
expense andaircraftweightduetooverdesign-atworst, underdesign. 

4.2.1 Pin-Injection Tests 

Pin-injection tests are designed to define a very specific level of 
damage tolerance. Depending on the type of EUT, these tests should 
be conducted with different methods and different pass/fail criteria. 

For simple electrical/electromechanical components, such as 
valves, solenoids and switches, which are normally isolated from 
case or aircraft ground, the hipot or dielectric-withstand test is used. 
The EUT is unpowered and test currents are applied pin-to-case in 
accordance with specified ETDLs and idealized waveforms of DO- 
160. Figure 5a gives a typical test setup. Ifthe EUT suffers no voltage 
breakdown to case, then the unit has been verified to withstand the 
specified damage-tolerance ETDL. 


For simple electrical/electromechanical components which are 
normally referenced to case or local aircraft ground, a circuit- 
damage tolerance test is also required. In this situation, the EUT is 
normally powered because the follow-on currents from the power 
bus would accentuate any damage and make detection of potential 
circuit damage clearly distinguishable. Test currents are applied pin- 
to-case or pin-to-pin. Figure 5b illustrates a typical configuration. If 
no unintentional voltage breakdown to case occurs and there is no 
component damage, then the EUT has passed. Some equipment 
includes suppression devices that will intentionally shunt current to 
case. 

For more complex electrical and electronic components -typi- 
cally those containing solid-state circuitry - two possible conditions 
exist. When, under normal operating conditions, operating voltage 
constraints, impedance definitions, ground conditions and loading 
characteristics for the EUT are controlled by other equipment 
supplied by a different vendor, and the EUT manufacturer has no 
indication of suppression devices or filtering on interconnecting 
wiring, then pin tests must be performed to full specification of 
voltage and current. 

In the second case, if loads and other operating parameters for the 
EUT are under the control of the EUT manufacturer, then any line- 
to-ground surge impedance and line-to-ground load impedance 
which exist in the interconnecting wiring may be used to relax test 
currents applied to the appropriate EUT pin. Since cable lengths and 
geometry play a role in surge characteristics, and they are not usually 
under the control of the EUT manufacturer, then relaxation of the 
specifications should be limited to line-to-ground transmission line 
impedances only - typically from full specification of 5 ohms to 50 
to 1 00 ohms. This is usually applied only to waveforms 2 and 4, and 
waveform 5 if used as a pin test. 

In both cases, power is applied to the unit, but loads are not 
interconnected. Transients are applied pin-to-case or pairs of pins- 
to-case under the assumption that case is power ground. Pass/fail 
conditions are again unintentional voltage breakdown, component 
damage and loss of function after the EUT is reconnected to the 
system. One special condition which must be considered is that 
testing must assess the possibility of change-of-state in the circuitry. 
To ensure that worst-case situations have been evaluated, circuits 
should be tested in both states. Because verification tests are per- 
formed under certification conditions and EUT configuration may 
not be altered, some developmental breadboard testing of specific 
circuits may be required to evaluate certain circuits in both states. 




FIGURE 5a Pin-injection of an ungrounded system 


FIGURE 5 b Pin-injection of a grounded system 
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4.2.2 Functional tests 

Functional tests are designed to evaluate the LRU, its wiring 
harnesses and its loads as an integrated and functioning system or 
subsystem. DO- 160 is again a minimum requirement specification 
designed for off-the-shelf components; when that component is 
integrated into a system, the ETDL verification should reflect the 
actual configuration of the installed system. Particular attention 
should be given to ensure that bench tests reflect the actual lengths, 
orientation and operating conditions of interconnecting wiring, such 
as cable routing, cable size, cable types, shielding, cable branching, 
actual loads or load simulation. In short, transient susceptibility 
should be verified to actual configuration for each and every wire, not 
to a generic cable-bundle specification. ETDLs should be tested 
separately to each interface, not simultaneously to all interfaces, 
because this would pose a much lower threat to certain LRU 
interfaces. For example, if 1000 amps is specified for a connector, 
then 1000 amps should be applied to each connector, not 1000 amps 
applied to a cable bundle with many connectors. The setups illus- 
trated in DO-1 60 are very generic, consisting of one LRU, with one 
cable and one load; most actual installations are not as simple. DO- 
1 60 must be used as a baseline and adopted to die aircraft installation. 
The closer the test setup is to actual installation, the less analysis will 
be required to correlate the test with verification requirements. The 
result will be increased safety, and may also reduce the use of 
unnecessary suppression devices. If generic tests require that every 
interface withstand a specified level of threat, but a thorough 
simulation shows that particular connectors will be subject to lower 
transient levels due to their actual configuration, those connectors 
will require less protection. 

In all such tests, the EUT must be fully functional. System 
responses, as seen by the pilot, are monitored for unacceptable 
responses per specified pass/fail criteria. 

5.0 RESPONSIBILITIES 

Because it is rarely practical to perform full-threat tests on fully 
configured aircraft, the key to successful protection will be the 
degree to which the system and subsystem tests simulate actual 
internal lightning conditions to be expected in the complete aircraft 
with all components interconnected and operational. These tests will 
depend in turn, upon the accuracy of the airframe manufacturer’s or 
system integrator’s prediction of TCLs, die thoroughness of ETDL 
verification as tested by the system suppliers, and the sufficiency of 
the margins to account for any uncertainties in these conditions. The 
coordination between the airframe manufacturer and system/sub- 
system suppliers in this process is fundamental to adequate protec- 
tion. 
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